Event database management method and system for network event reporting system

• US 7,516,208 B1
• Filed: 07/20/2001
• Issued: 04/07/2009
• Est. Priority Date: 07/20/2001
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Banyard, Nicholas S., Stewart, Kristian Jon, Kerrison, Adam Geoffrey, Bennett, Andrew Jonathan
• Primary Examiner(s): LAZARO, DAVID R
• Application Number:
  US09/910,676
• Time in Patent Office: 2,818 Days
• Field of Search: 379/134, 379/32.01, 379/32.02, 707/10, 707/8, 707/104.1, 707/201, 709201-203, 709/206, 709/207, 709223-225
• US Class Current: 709/224
• CPC Class Codes: H04L 41/024 using relational databases for representation of network management data, e.g. managing via structured query language [SQL]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image
• CPC Class Codes: Y10S 707/99952 Coherency, e.g. same view to multiple users

Abstract

Improved and more efficient techniques are described for reducing the amount of work that needs to be performed by a database in a computer network in order to distribute event summary data to a large number of administrator clients. Delays experienced by event data at a database, e.g., due to delays in accessing a database, are reduced so that client can be notified of the events as soon as possible. Furthermore, event data obtained from both local and remote networks is efficiently coordinated using replica and union processes. Each monitoring location in the network includes both locally generated events, and a copy of remotely-generated events which are provided and maintained by one or more remote monitoring locations. The monitoring locations update one another with their event data.

Claims

1. A method for providing an improved network monitoring system, the network monitoring system comprising an event database for storing event data representing events occurring on the network, the event data being gathered by a plurality of monitoring devices located at a plurality of different, remote locations on the network, the method comprising:

allowing users to insert one or more triggers into the event database, the triggers automatically initiating a programmed response at the detection of an event including gathered event data prior to insertion of the gathered event data into the event database, the event is one of a primitive event, a database event or a temporal event;

distributing the event database to a plurality of remote network locations, wherein each remote network location stores a local table containing event data generated at the remote location and one or more replica tables containing event data generated at other remote locations, and wherein a union of the local and replica tables is generated to form a combined event database at the remote location; and

using triggers and local and replica table unions during delivery of event data to users of the network monitoring system wherein the local and replica tables update one another when the event data of one of said tables changes.

2. The method of claim 1, comprising providing a notification component for registering similar client requests for event data and substantially contemporaneously delivering requested event data to all clients having similar registered requests.

3. An event database for use in a network monitoring system, the event database storing event data representing events occurring on the network, the event data being gathered by a plurality of monitor devices located at a plurality of different, remote locations on the network, the event database comprising:

an automation engine for processing one or more triggers contained in the event database, the triggers automatically initiating a programmed response at the detection of an event including on gathered event data prior to insertion of the gathered event data into the event database, the event is one of a primitive event, a database event or a temporal event;

a local table stored at each remote network location containing event data generated at the remote location;

one or more replica tables stored at each remote network location containing event data generated at other remote locations, wherein a union of the local and replica tables is generated to form a combined event database at the remote location, and wherein the local and replica tables update one another when the event data of one of said tables changes.

4. A method for handling event data from monitored sites in a computer network, comprising:

receiving event data from the sites at a monitoring location;

when received at the monitoring location, pre-processing the event data before the event data is inserted into an event database to determine if an event is met as set forth in a trigger;

if the trigger event is met, initiating an action relating to the event data, the action being defined in the trigger, the event is one of a primitive event, a database event or a temporal event;

inserting the event data into the event database thereby producing central data; and

transmitting the central data to each of the monitored sites;

wherein each of the monitored sites includes locally-generated event data and a replica of the central data;

wherein a union of the locally-generated event data and the central data is formed at each of the monitored sites; and

wherein the monitored sites update one another when the event data of one of said monitored sites changes.

5. The method of claim 4, wherein pre-processing the event data comprises determining whether the event data comprises a duplication of other event data in the event database or received at the monitoring location.

6. The method of claim 5, wherein initiating the action comprises denying storage of the event data in the event database if it comprises a duplication of other event data.

7. The method of claim 4, wherein if the event data does not meet the event, it is temporarily stored outside the data store.

8. The method of claim 4, wherein for event data received at the monitoring location, a query is executed, and an event is evaluated, which, if true, causes the execution of the action.

9. The method of claim 8, wherein the action comprises at least one of a sequence of Structured Query Language (SQL) statements and an external script.

10. The method of claim 4, wherein the trigger has a coupling mode that indicates when the action should be executed.

11. The method of claim 4, wherein the trigger allows an administrator of the network to connect events, conditions and actions.

12. The method of claim 4, wherein the event data comprises a primitive event.

13. The method of claim 4, wherein the event data comprises a database event.

14. The method of claim 4, wherein the event data comprises a temporal event.

15. The method of claim 4, wherein the trigger comprises a database trigger.

16. The method of claim 4, wherein the trigger comprises a temporal trigger.

17. The method of claim 16, wherein the temporal trigger signals an event at a determined frequency from a specified start time until a specified end time.

18. The method of claim 4, wherein initiating an action comprises communicating a message in accordance with the event data to at least one customer location that has subscribed to receive the event data, and storing the event data in a data store at the monitoring location.

19. The method of claim 18, wherein the pre-processing occurs, at least in part, during a period when the data store is inaccessible.

20. The method of claim 18, wherein the message communicated in accordance with the event data is included in the union of at least event data of a local network and event data of a remote network.

21. The method of claim 20, wherein the union comprises a union of event data tables.

22. The method of claim 4, wherein the monitoring locations update one another with their event data.

23. The method of claim 4, wherein at least one monitoring location is enabled to take ownership of a replica of remotely-generated event data to make modifications thereto without instructions from the remote monitoring location associated therewith.

24. A system for handling event data from monitored sites in a computer network, comprising:

means for receiving event data from the sites at a monitoring location;

means for pre-processing the event data, when received at the monitoring location, to determine if a condition is met for setting a trigger;

means for communicating a message, if the trigger is set, in accordance with the event data to at least one customer location that has subscribed to receive the event data, and storing the event data in a data store at the monitoring location, the trigger being in response to a primitive event, a database event or a temporal event;

means for inserting the event data into the event database thereby producing central data; and

means for transmitting the central data to each of the monitored sites;

wherein each of the monitored sites includes locally-generated event data and a replica of the central data;

wherein a union of the locally-generated event data and the central data is formed at each of the monitored sites; and

wherein the monitored sites update one another when the event data of one of said monitored sites changes.